-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2797-1 security@xxxxxxxxxx http://www.debian.org/security/ Michael Gilbert November 16, 2013 http://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : chromium-browser Vulnerability : several Problem type : remote Debian-specific: no CVE ID : CVE-2013-2931 CVE-2013-6621 CVE-2013-6622 CVE-2013-6623 CVE-2013-6624 CVE-2013-6625 CVE-2013-6626 CVE-2013-6627 CVE-2013-6628 CVE-2013-6629 CVE-2013-6630 CVE-2013-6631 CVE-2013-6632 Several vulnerabilities have been discovered in the chromium web browser. CVE-2013-2931 The chrome 31 development team found various issues from internal fuzzing, audits, and other studies. CVE-2013-6621 Khalil Zhani discovered a use-after-free issue in speech input handling. CVE-2013-6622 cloudfuzzer discovered a use-after-free issue in HTMLMediaElement. CVE-2013-6623 miaubiz discovered an out-of-bounds read in the Blink/Webkit SVG implementation. CVE-2013-6624 Jon Butler discovered a use-after-free issue in id attribute strings. CVE-2013-6625 cloudfuzzer discovered a use-after-free issue in the Blink/Webkit DOM implementation. CVE-2013-6626 Chamal de Silva discovered an address bar spoofing issue. CVE-2013-6627 skylined discovered an out-of-bounds read in the HTTP stream parser. CVE-2013-6628 Antoine Delignat-Lavaud and Karthikeyan Bhargavan of INRIA Paris discovered that a different (unverified) certificate could be used after successful TLS renegotiation with a valid certificate. CVE-2013-6629 Michal Zalewski discovered an uninitialized memory read in the libjpeg and libjpeg-turbo libraries. CVE-2013-6630 Michal Zalewski discovered another uninitialized memory read in the libjpeg and libjpeg-turbo libraries. CVE-2013-6631 Patrik Höglund discovered a use-free issue in the libjingle library. CVE-2013-6632 Pinkie Pie discovered multiple memory corruption issues. For the stable distribution (wheezy), these problems have been fixed in version 31.0.1650.57-1~deb7u1. For the testing distribution (jessie), these problems will be fixed soon. For the unstable distribution (sid), these problems have been fixed in version 31.0.1650.57-1. We recommend that you upgrade your chromium-browser packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/ Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.15 (GNU/Linux) iQQcBAEBCgAGBQJSiChzAAoJELjWss0C1vRzU4Qf/RvGDovXCQzKN1JKFWr+VDhu OfwJAd5DZUd/EAe8ZgfTrmivl6gTYYLI6ulRcyhlQyDXuQcg7+pz33/97Q/At77f nm6jfo1eZQN674NZ+H5lL3ZcVmnxubXGa0Ro+Q5QghS6lcvQ3G684j+t8wnyAu9s IYcwxgjVlIUvHMa6j4jep6x/hL3UWEnWNGBx6FtL9vR+832BRU9L9ngZsy7BLsKy gAn2XvU2R1GUkPfwG0gu0dXSHG0DTYeDSGdcAblFgnDUgcZLr1VXfNqRv3y47LVS npL/a4HWqqFBbEsa4Pho1zepADs5RRgnOple90xIsCIcmq+YZ/AvDP0N+AFOY4FV 0NNOWOwfsVhcSengrJmsc6+W5RX1VtDVzhrtkQYD+dEgVj2HLdRKzju7qLMj2sJz nzzVGMcZ8Gz3CnR31mEioeE9fj8DzRXPMf+6oyqpfzttprGg6F3s7elVEFjKfRbf crxjm1Rok9g4vGNFEfNPFEqzFvjgzd7zkT6Xrd2HPqOSrnWjAWOxhdaBQmtuUmYt QqkJWLUREWwqXLYE6PMSmLO6dAO1z8DU25R37TdD3aa5U2qzabAxwsUCQ2iLt9W8 /xY8RTdR/L28wa0zC1xEWdObdgAj5+B8ZAw8sbENlVytLV8o4GlfDaX7PaC8YYAn 0/N+CjDWS2QEnQgBuL8pNpbFc1cyEpLqmboE4k5Vg4hAjUsAvE+KimTv/pdmfEwU D9qzA37NM17hfU7KOMBtYLJ5pQLS5JnyHVDwy8iCQUP72HS8dvc4nvrW6feTE7w3 jseUvtwG2MLdp/lUXDzGw8Vr60wXmAMFU298jOb8d38YajzMdSbkihNDq1OWCZ+v lvFBjfOlxZtR+xIYJjrfe41oAD84Dk7j31o9o4OHelCP0Ur7o49PlFWkaRegMeyL /F82W1oyKNKaoiAGenlRBJFwmqKlC4uebkYL2juRuRcTd0D4tNKmlFK04LlGkTMG RzfO20owjh2e4CQYbf96zXod0MurhbzdBIzEEQDhxSAQJHFmzO9zKa0opsVteXNU egcxdp7xTk744q9uyb9mJOyswer6YyYiRxT9I5Je3+DCJcQVnoZZICV4cqZ020hj yNJjepdJgNg48fg5HwpVJYx7BFdmU4DFga0zcr22r0oCw0Ywnbnq9ePvjX2ZUsfM QVXeh6oGz8u2+9su5uDvba+r3gEg+pxhMFp1Ce4gvBISdzvydpPERN5mqA5QVGSE +B1NwTdf9UzJ/CbA4seh03Kq+CYxmnNzekTIa6kTX49xkuroV/bAkU4UuZqdYORE m7onNL073yMBpS4jfPgq0zEFIohseX0m8+Cdd1maCV819HeopjTaajY94DL2Hrk= =jrjN -----END PGP SIGNATURE-----
